HHS Log--links to Department of Health and Human Services website

horizontal rule

Food and Drug Administration
From the Privacy Act Online via GPO Access

09-10-0002 Regulated Industry Employee Enforcement Records, HHS/FDA/OC.
09-10-0003 FDA Credential Holder File, HHS/FDA/OC.
09-10-0004 Communications (Oral and Written) With the Public, HHS/FDA/OC.
09-10-0005 State Food and Drug Official File, HHS/FDA/ ORA.
09-10-0007 Science Advisor Research Associate Program (SARAP), HHS/FDA/ORA.
09-10-0008 Radiation Protection Program Personnel Monitoring System, HHS/FDA/CDRH.
09-10-0009 Special Studies and Surveys on FDA- Regulated Products, HHS/FDA/OM.
09-10-0010 Bioresearch Monitoring Information System, HHS/FDA.
09-10-0011 Certified Retort Operators, HHS/FDA/CFSAN.
09-10-0013 Employee Conduct Investigative Records, HHS/FDA/OM.
09-10-0017 Epidemiological Research Studies of the Center for Devices and Radiological Health, HHS/FDA/ CDRH.
09-10-0018 Employee Identification Card Information Records, HHS/FDA/OC.
09-10-0019 Mammography Quality Standards Act (MQSA) Training Records, HHS/FDA/CDRH.

09-10-0002

System name: Regulated Industry Employee Enforcement Records, HHS/FDA/OC.

Security classification: None.

System location:

FDA employees:
Administrative Services Branch (HFA-210), 5600 Fishers Lane, Rockville, MD 20857
Investigations Operations Branch (HFC-132), 5600 Fishers Lane, Rockville, MD 20857
Administrative, Investigations, and Compliance Branches at Field/District Offices. For the location of Field/District Offices, see Appendix A.
For the location of Federal Records Centers, see Appendix B.

Categories of individuals covered by the system:
Employees of enterprises regulated by the Food and Drug Administration (FDA) and other individuals subject to FDA enforcement actions.

Categories of records in the system: Includes correspondence, memoranda, inspection reports, and
related documents that are investigatory material compiled for law enforcement purposes.

Authority for maintenance of the system:
Federal Food, Drug and Cosmetic Act (21 U.S.C. 321 et seq.), the Public Health Service Act (42 U.S.C. 201 et seq.), and authority delegated to the Commissioner, 21 CFR part 5.

Purpose(s):
To provide records used by FDA employees in investigations of possible violation of the law.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:

Records that indicate violation or potential violation of law may be: (1) Referred for investigation and possible enforcement action under the applicable Federal, State, or foreign laws to the Department of Justice and other appropriate Federal agencies; an appropriate State food and drug enforcement health agency or licensing authority; or, the government of a foreign country; or (2) disclosed in administrative or court proceeding in determining whether a record is relevant to an Agency decision concerning documents of investigatory materials.
Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from that congressional office at the request of that individual.
The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
(a) HHS, or any component thereof; or
(b) Any HHS employee in his or her official capacity; or
(c) Any HHS employee in his or her individual capacity where the
Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
(d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components,

Is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:
Manual files are maintained in letter-size folders. Automated files are maintained on computer discs and tapes stored ina locked
safe.

Retrievability:
Indexed by company or subject, sometimes with individual name in a cross-index on an automated index system.

Safeguards:

Authorized users: Administrative Services Branch and Office of Regulatory Affairs personnel.
Physical safeguards: Records are kept in locked cabinets in a secured area, locked rooms, locked buildings and limited access to authorized personnel. Computer tapes and discs are stored in a locked safe.
Procedural (or technical) safeguards: Computer software providing restricted commands.
Implementation guidelines: Safeguards are established in accordance with Chapter 45-13 and PHS hf: 45-13 of the Department's General Administration Manual and Part 6 of the Department's ADP Systems Manual.

Retention and disposal:
Records may be retired to a Federal Records Center and subsequently disposed of in accordance with FDA's Records Control Schedule. The Records Control Schedule and disposal standard for these records may be obtained by writing to the system manager at the address below.

System manager(s) and address:
The policy coordinating official for this system of records is also the system manager for the Investigations Operations Branch.
Chief, Administrative Services Branch (HFA-210), 5600 Fishers Lane, Rockville, MD 20857
Assistant to the Director, Investigations Operations Branch (HFC-132), Office of Regulatory Affairs, 5600 Fishers Lane, Rockville, MD 20857
Director, Office of Criminal Investigations, Office of Regulatory Affairs, (HFC-300), 7500 Standish Place, Suite 250N, Rockville, MD 20855Administrative, Investigative and Compliance Branches at Field/District Offices, see Appendix A.

Record access procedures:
Same as notification procedures. Requesters should also reasonably specify the record contents being sought. Access to record systems which have been granted an exemption from the Privacy Act access requirement may be made at the discretion of the system manager. If access is denied to requested records, an appeal may be made to: Commissioner, Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857. You may also request an accounting of disclosures that have been made of your record, if any.

Contesting record procedures:
If access has been granted, contact the official at the address specified under notification procedures and reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely or irrelevant.

Record source categories:
Individual on whom the record is maintained, from third parties such as consumers, scientists, representatives of other companies, state agencies, or developed by FDA during investigations for law enforcement purposes.

Systems exempted from certain provisions of the act:
This system is exempt from access and contest and certain other provisions of the Privacy Act (5 U.S.C. 552a (c)(3), (d)(1) to (4), (e)(3), (e)(4)(G) to (H) and (f), to the extent that it includes investigatory material compiled for law enforcement purposes, including criminal law enforcement purposes, where access would be likely to prejudice the conduct of the investigation.

Appendix A- Addresses and working hours of the Food and Drug Administration Field Offices

The following is a list of the Food and Drug Administration Field Offices, their addresses and working hours where individuals may have access to records in Food and Drug Administration Privacy Act Record Systems:

NORTHEAST REGION
Regional Office
830 Third Avenue, Brooklyn, NY 11232, Office hours: 8 am to 4:30 pm (e.s.t.).
District Offices
One Montvale Avenue, 3rd Floor, Stoneham, MA 02180, Office hours: 8 am. to 4:30 pm (e.s.t.).
850 Third Avenue, 4th Floor, Brooklyn, NY 11232-1593, Office hours: 8 am to 4:30 pm (e.s.t.).
599 Delaware Avenue, Buffalo, NY 14202, Office hours: 8 am to 4:30 pm (e.s.t.).
Regional Laboratory
850 Third Avenue, 4th Floor, Brooklyn, NY 11232-1593, Office hours: 8 am to 4:30 pm (e.s.t.).
Winchester Engineering and Analytical Center (WEAC), 109 Holton Street, Winchester, MA 01890.

MID-ATLANTIC REGION
Regional Office
2nd and Chestnut Streets, Room 900, Philadelphia, PA 19106, Office hours: 8 am to 4:30 pm (e.s.t.).
District Offices
2nd and Chestnut Streets, Room 900, Philadelphia, PA 19106, Office hours: 8 am to 4:30 pm (e.s.t.).
61 Main Street, West Orange, NJ 07052, Office hours: 8 am to 4:30 pm (e.s.t.).
900 Madison Avenue, Baltimore, MD 21201, Office hours: 7:45 am to 4:15 pm (e.s.t.).
1141 Central Parkway, Cincinnati, OH 45202-1097, Office hours: 8 am to 4:30 pm (e.s.t.).

SOUTHEAST REGION
Regional Office
60 Eighth Street, NE, Atlanta, GA 30309, Office hours: 8 am to 4:30 pm (e.s.t.).
District Offices
60 Eighth Street, NE, Atlanta, GA 30309, Office hours: 8 am to 4:30 pm (e.s.t.).
297 Plus Park Boulevard, Nashville, TN 37217, Office hours: 8 am to 4:30 pm (c.t.).
7200 Lake Ellenor Drive, Suite 120, Orlando, FL 32809, Office hours: 8 am to 4:30 pm (e.s.t.).
4298 Elysian Fields Avenue, New Orleans, LA 70122, Office hours: 8 am to 4:30 pm (c.t.).
Fernandez Juncos Avenue, Puerta de Tierra, San Juan, PR 00906-5719, Office hours: 8 am to 4:30 pm (e.s.t.).
Regional Laboratory
60 Eighth Street, NE, Atlanta, GA 30309, Office hours: 8 am to 4:30 pm (e.s.t.).

MIDWEST REGION
Regional Office
20 N. Michigan Avenue, Room 550, Chicago, IL 60602, Working hours: 8 am to 4:30 pm (e.s.t.).
District Offices
433 W. Van Buren Street, Room 1222, Chicago, IL 60607, Working hours: 8 am to 4:30 p.m. (e.s.t.).
1560 East Jefferson Avenue, Detroit, MI 48207, Office hours: 8 am to 4:30 pm (e.s.t.).
240 Hennepin Avenue, Minneapolis, MN 55401, Office hours: 8 am to 4:30 pm (c.t.).

SOUTHWEST REGION
Regional Office
3032 Bryan Street, Dallas, TX 75204, Office hours: 8 am to 4:30 (c.t.).
District Offices
3032 Bryan Street, Dallas, TX 75204, Office hours: 8 am to 4:30 (c.t.).
1009 Cherry Street, Kansas City, MO 64106, Office hours: 8 am to 4:30 pm (c.t.).
Denver Federal Center, Building 20, PO Box 25087, Denver, CO 80225-0087, Working hours: 8 am to 4:30 pm (m.t.).

PACIFIC REGION
Regional Office
Federal Office Building, Room 526, 50 U.N. Plaza, San Francisco, CA 94102, Working hours: 8 am to 4:30 pm (p.t.).
District Offices
Federal Office Building, Room 526, 50 U.N. Plaza, San Francisco, CA 94102, Working hours: 8 am to 4:30 pm (p.t.).
1521 W. Pico Boulevard, Los Angeles, CA 90015-2486, Office hours: 8 am to 4:30 pm (p.t.).
22201 23rd Drive, SE, Bothell, WA 98021-4421, Office hours: 8 am to 4:30 pm (c.t.).

Appendix B--General Services Administration, Federal Archives, and Records Centers

National Centers:
District of Columbia, Maryland, Virginia, and West Virginia except for U.S. Court records for Maryland, Virginia, and West
Virginia: Washington National Records Center, Washington, DC 20409.
National Personnel Records Center (Civilian Personnel Records), 111 Winnebago Street, St. Louis, MO 63118.
National Personnel Records Center (Military Personnel Records), 9700 Page Boulevard, St. Louis, MO 63132.

Regional Centers
Maine, Vermont, New Hampshire, Massachusetts, Connecticut, and Rhode Island, Federal Archives and Records Center, 380 Trapelo Road, Waltham, MA 02154.
New York, New Jersey, Puerto Rico, the Virgin Islands, and the Panama Canal Zone, Federal Records Center, Military Ocean Terminal, Building 22, Bayonne, NJ 07002-5388.
Delaware, Pennsylvania, and U.S. Court records for Maryland, Virginia, and West Virginia, Federal Records Center, 5000 Wissahickon Avenue, Philadelphia, PA 19144.
North Carolina, South Carolina, Tennessee, Mississipi, Alabama, Georgia, Florida and Kentucky, Federal Records Center, 1557 St. Joseph Avenue, East Point, GA 30344.
Illinois, Wisconsin, Minnesota, and U.S. Court records for Indiana, Michigan, and Ohio, Federal Records Center, 7358 South Pulaski Road, Chicago, IL 60629.
Indiana, Michigan, and Ohio except for U.S. Court records, Federal Records Center, 3150 Springboro Road, Dayton, OH 45439.
Kansas, Iowa, Nebraska, and Missouri, Federal Records Center, 2306 East Bannister Road, Kansas City, MO 64131.
Texas, Oklahoma, Arkansas, Louisiana, and New Mexico, Federal Records Center, PO Box 6216, Fort Worth, TX 76115.
Shipping address only (do not use for mail), 4900 Hemphill Street, Building 1, Dock 1, Fort Worth, TX.
Colorado, Wyoming, Utah, Montana, North Dakota, and South Dakota, Federal Records Center, PO Box 25307, Denver, CO 80225.
American Samoa, California, except Southern California, and Nevada, except Clark County, Federal Records Center, 1000 Commodore Drive, San Bruno, CA 94066.
Arizona; Clark County, Nevada; and Southern California (counties of San Luis Obispo, Kern, San Bernardino, Santa Barbara, Ventura, Los Angeles, Riverside, Orange, Imperial, Inyo, and San Diego). Federal Records Center, 24000 Avila Road, 1st Floor, PO Box 6719, Laguna Niguel, CA 92677.
Washington, Oregon, Idaho, Alaska, Hawaii, and Pacific Ocean areas (except American Samoa), Federal Records Center, 6125 Sand Point Way NE, Seattle, WA 98115.

From the Privacy Act Online via GPO Access [wais.access.gpo.gov]
rule

09-10-0003

System name: FDA Credential Holder File, HHS/FDA/OC.

Security classification: None.

System location:

FDA employees:

Personnel Property Management Section, (HFA-227), Office of Management, 5600 Fishers Lane, Rockville, MD 20857
Metropolitan Office Services Section (HFA-216), Office of Management, 200 C Street, SW, Washington, DC 20204
Division of Field Investigations (HFC-130), Office of Regulatory Affairs, 5600 Fishers Lane, Rockville, MD 20857
Administrative Branch at Field/District Offices. For the location of Field/District Offices, see appendix A to system notice 09-10-0002, Regulated Industry Employee Enforcement Records, HHS/FDA/OC.
State and Local Employees: Division of Federal-State Relations (HFC-151), 5600 Fishers Lane, Rockville, MD 20857.
Administrative Branch at Field/District Offices. For the location of Field/District Offices, see appendix A to system notice 09-10-0002, Regulated Industry Employee Enforcement Records, HHS/FDA/OC.

Categories of individuals covered by the system:
FDA employees and state and local government employees who have been issued FDA credentials for enforcement activities.

Categories of records in the system:
Contains name, job title, height, weight, color of eyes and hair, duty status, and for state and local government employees, professional qualifications.

Authority for maintenance of the system:
Sections 702 to 704, the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 372 to 374).

Purpose(s):
To issue or reissue credentials which are used to gain entry to regulated establishments.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:
Information may be disclosed to provide assurance to regulated enterprises that an individual is a duly designated enforcement officer and, in the case of state employees, an officer commissioned as an officer of the Department. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
(a) HHS, or any component thereof; or
(b) Any HHS employee in his or her official capacity; or
(c) Any HHS employee in his or her individual capacity where the
Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
(d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:
Maintained in file folders and on computer tapes.

Retrievability:
Indexed by name.

Safeguards:
1. Authorized users: Administrative Services Branch and Office of Regulatory Affairs personnel.
2. Physical safeguards: Records are kept in locked cabinets in a secured area, locked rooms, locked buildings and limited access to authorized personnel. Computer tapes and discs are stored in locked safe.
3. Procedural (or technical) safeguards: Computer software providing restricted commands.
4. Implementation guidelines: Safeguards are established in accordance with Chapter 45-13 and PHS hf:45-13 of the Department's General Administration Manual and Part 6 of the Department's ADP Systems Manual.

Retention and disposal:
Records are retained as long as individual is a duly designated or commissioned official; inactive files destroyed after 10 years.
The records are destroyed by shredding, burning, or other appropriate means so as to render them illegible.

System manager(s) and address:
FDA employees:

Chief, Services Unit (HFA-227), Office of Management, 5600 Fishers Lane, Rockville, MD 20857
Chief, Metropolitan Office Services Unit (HFA-216), Office of Management, 200 C Street, SW, Washington, DC 20204

Administrative Branch at Field/District Offices. For the location of Field /District Offices, see appendix A to system notice 09-10- 0002, Regulated Industry Employee Enforcement Records, HHS/FDA/OC. Federal-State Officer at Field/District Offices. For the location of Field/District Offices, see appendix A to system notice 09-10- 0002, Regulated Industry Employee Enforcement Records, HHS/FDA/OMO/ DMS.

State employees:

Director, Division of Federal-State Relations (HFC-151), 5600 Fishers Lane, Rockville, MD 20857.

Administrative Branch at Field/District Offices. For the location of Field/District Offices, see appendix A to system notice 09-10- 0002, Regulated Industry Employee Enforcement Records, HHS/FDA/OC.

Notification procedure:

An individual may learn if a record exists about him or her upon written request, with notarized signature if request is made by mail, or with identification if request is made in person, directed to: FDA Privacy Act Coordinator (HFI-30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857

Record access procedures:

Same as notification procedure. Requesters should also reasonably specify the record contents being sought. You may also request an accounting of disclosures that have been made of your record, if any.

Contesting record procedures:

Contact the official at the address specified under notification procedure above and reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.

Record source categories: individual on whom the record is maintained.

Systems exempted from certain provisions of the act:
None.

From the Privacy Act Online via GPO Access [wais.access.gpo.gov]

09-10-0004

System name: Communications (Oral and Written) With the Public, HHS/FDA/OC.

Security classification:
None.

System location:

Administrative Services Branch (HFA-210), 5600 Fishers Lane, Rockville, MD 20857 Office of Legislative Affairs (HFW-1), 5600 Fishers Lane, Rockville, MD 20857

Administrative Branch at Field/District Offices. For the location of Field/District Offices, see appendix A to system notice 09-10- 0002, Regulated Industry Employee Enforcement Records, HHS/FDA/OMO/ DMS. For the location of Federal Archives and Records Centers, see appendix B to system notice 09-10-0002, Regulated Industry Employee Enforcement Records, HHS/FDA/OMO/DMS.

Categories of individuals covered by the system:
Individuals, other than employees of enterprises regulated by FDA, who communicate with FDA or, in some cases, are the subject of communications by others with FDA.

Categories of records in the system:
Includes correspondence from and to individuals, summaries of conversations prepared by FDA employees, and records prepared by FDA as a follow-up to consumer complaints, oral and written. Administrative Services Branch files include copies of correspondence received from the public, and the FDA reply. The Office of Legislative Affairs maintains duplicates of letters FDA sends to members of Congress and summaries of oral inquiries in files organized by members' names. The Office of Legislative Affairs maintains a manual control system and the Executive Secretariat, Office of the Commissioner, maintains an automated control system of pending correspondence requiring a reply.

Authority for maintenance of the system:
Federal Food, Drug, and Cosmetic Act (21 U.S.C. 321 et seq.); the Public Health Service Act (42 U.S.C. 201 et seq.), and authority delegated to the Commissioner (21 CFR 5.1).

Purpose(s):
To aid FDA employees in carrying out their responsibilities, e.g., responding to follow-up correspondence on complaints, requests for information, etc.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:
Records that indicate violation or potential violation of law may be: (1) Referred for investigation and possible enforcement action under the applicable Federal, State, or foreign laws to the Department of Justice; an appropriate State food and drug enforcement health agency or licensing authority; or the government of a foreign country; or (2) disclosed in administrative or court proceedings in determining whether a record is relevant to an agency decision concerning documents of investigatory materials. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
(a)HHS, or any component thereof; or
(b) Any HHS employee in his or her official capacity; or
(c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
(d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:
Manual records are maintained in letter-size folders. Automated records are maintained on computer tapes and discs and stored in a locked safe.

Retrievability:
Records are arranged by company or by subject. A computer index gives correspondent's name, date of letter, subject, and location. Field offices file consumer complaints by complaint number.

Safeguards:

1. Authorized users: FDA employees who display an FDA identification card; GAO employees upon approval of GAO Liaison Officer, Operations Coordination Staff, OMO, employees of DHHS agencies other than FDA whose duties require the use of information in the system.

2. Physical safeguards: Records are stored in locked cabinets in secured areas, locked buildings and locked rooms. Computer tapes and discs are stored in a locked safe.

3. Procedural (or technical) safeguards: Computer software providing restricted commands. Employees of DHHS agencies other than FDA must display government identification card, complete agreement between FDA and the agency concerned, and sign a commitment to protect privileged information.

4. Implementation guidelines: Safeguards are established in accordance with Chapter 45-13 and PHS hf:45-13 of the Department's General Administration Manual and part 6 of the Department's ADP Systems Manual.

System manager(s) and address:
Chief, Administrative Services Branch (HFA-210), 5600 Fishers Lane, Rockville, MD 20857 Office of Legislative Affairs (HFW-1), 5600 Fishers Lane, Rockville, MD 20857 Administrative Branch at Field/District Offices. For the location of Field/District Offices, see appendix A to system notice 09-10- 0002, Regulated Industry Employee Enforcement Records, HHS/OMO/DMS.

Notification procedure:
An individual may learn if a record exists about him or her upon written request with notarized signature if request is made by mail, or with identification if request is made in person, directed to: FDA Privacy Act Coordinator (HFI-30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857

Record access procedures:
Same as notification procedure. Requesters should also reasonably specify the record contents being sought. You may also request an accounting of disclosures that have been made of your record, if any.

Contesting record procedures:
Contact the official at the address specified under notification procedure above and reasonably specify the record, information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.

Record source categories:
Individual on whom the record is maintained or others (generally members of Congress) who write to FDA about them.

Systems exempted from certain provisions of the act:
None.

From the Privacy Act Online via GPO Access [wais.access.gpo.gov]

09-10-0005

System name: State Food and Drug Official File, HHS/FDA/ORA.

Security classification: None.

System location:
Regional Food and Drug Offices (See Appendix A 0. Categories of individuals covered by the system: State officials who have responsibilities related to those of the Food and Drug Administration.

Categories of records in the system:
Contains name, date of birth, education and professional experience, and state in which employed. Authority for maintenance of the system: Section 702(a) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 372(a)).

Purpose(s):
To provide FDA with the names of State officials who have responsibilities related to those of the Food and Drug Administration.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:

(a) HHS, or any component thereof; or
(b) Any HHS employee in his or her official capacity; or
(c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
(d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:
Maintained in letter-size manila folders.

Retrievability:
Indexed by name and state.

Safeguards:
1. Authorized users: Personnel of the Division of Federal State Relations who are engaged in contracts or any other activity involving commissioning.

2. Physical safeguards: Records are kept in locked cabinets in a secured area, locked rooms and locked building.

3. Procedural safeguards: Users of personal information in the performance of their duties have been instructed to protect personal information from public view and from unauthorized personnel. Access is strictly limited to those staff members trained in accordance with the Privacy Act.

4. Implementation guidelines: Safeguards are established in accordance with Chapter 45-13 and PHS hf:45-13 of the Department's General Administration Manual.

Retention and disposal:
Records are retained as long as individual is a state employee.

System manager(s) and address:
Regional Food and Drug Directors (See Appendix A for Address).

Record access procedures:
Same as notification procedure. Requests should also reasonably specify the records content being sought. You may also request an accounting of disclosures that have been made of your record, if any.

Contesting record procedures:
Contact the official at the address specified under notification procedure above and reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.

Record source categories:
Individual on whom the record is maintained.

Systems exempted from certain provisions of the act:
None.

From the Privacy Act Online via GPO Access [wais.access.gpo.gov]

09-10-0007

System name: Science Advisor Research Associate Program (SARAP), HHS/FDA/ORA.

Security classification:
None.

System location:
Division of Field Science (HFC-140), Office of Regional Operations, 5600 Fishers Lane, Rockville, MD 20857. For the location of Federal Archives and Records Centers, see Appendix B to system notice 09-10-0002, Regulated Industry Employee Enforcement Records, HHS/FDA/OMO/DMS.

Categories of individuals covered by the system:
FDA field personnel who have applied to participate in full-time research effort under the program.

Categories of records in the system:
Contains name, curriculum vitae, description of research proposal, budget, and statement of career goals.

Authority for maintenance of the system:
Section 702(a) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 372(a); sections 301 of the Public Health Service (42 U.S.C. 241) and 311 of the PHS Act (42 U.S.C. 243).

Purpose(s):
To monitor the progress of research objectives of approved individual SARAP research projects.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses: Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:
Maintained in letter-size manila folders.

Retrievability:
Indexed by name.

Safeguards:

1. Authorized users: Personnel of the Division of Field Science.

2. Physical safeguards: Records are kept in locked cabinets in a secured area, locked rooms, and locked building.

3. Procedural safeguards: Users of personal information in the performance of their duties have been instructed to protect such information from public view and from unauthorized personnel. Access is strictly limited to those staff members trained in accordance with the Privacy Act.

4. Implementation guidelines: Safeguards are established in accordance with Chapter 45-13 and PHS hf:45-13 of the Department's General Administration Manual.

System manager(s) and address: Director, Division of Field Science (HFC-140), Office of Regional Operations, 5600 Fishers Lane, Rockville, MD 20857.

Record source categories:
Individual on whom the record is maintained.

Systems exempted from certain provisions of the act:
None.

From the Privacy Act Online via GPO Access [wais.access.gpo.gov]

09-10-0008

System name: Radiation Protection Program Personnel Monitoring System, HHS/FDA/CDRH.

Security classification: None.

System location:
Office of Health Physics (HFZ-60), Center for Devices and Radiological Health, 5600 Fishers Lane, Rockville, MD 20857 Radiation Detection Company, 162 Wolfe Road, PO Box 3414, Sunnyvale, CA 94088

Categories of individuals covered by the system:
U.S. Public Health Service and other personnel in clinics, laboratories, hospitals, research facilities, etc., who work with ionizing radiation sources and are required to be monitored by Nuclear Regulatory Commission or Occupational Safety and Health Administration regulations.

Categories of records in the system:
Contains name, date of birth, social security account number, job code, period of exposure, effective date, and radiation exposure value.

Authority for maintenance of the system:
Atomic Energy Act of 1954 (68 Stat. 919 et seq.), Nuclear Regulatory Commission Regulations, 10 CFR part 20; Occupational Safety and Health Act of 1970 (84 Stat. 1590 et seq.), Occupational Safety and Health Administration Regulations, 29 CFR 1910.96.

Purpose(s):
To monitor incremental and accumulated exposure to ionizing radiation for radiation protection purposes.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:
Results are disclosed to employers, i.e., clinics, laboratories, etc., after the end of each monitoring period.
Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual.
Disclosure may be made to HHS contractors and their staff in order to accomplish the purpose for which the records are collected. The recipients are required to protect such records from improper disclosure.
The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:
Maintained on magnetic disc computer data bank, with back-up stored securely off-site. Hard copies are maintained in letter-size folders.

Retrievability:
Indexed by name, social security account number, and facility.

Safeguards:

Authorized users: Authorized CDRH and contractor personnel who must have access to information in the system in the performance of their duties.
Physical safeguards: Hard copies are filed in secured files, locked building with controlling security personnel stationed at key access points to the record area.
Procedural (or technical) safeguards: Computer software is password protected and access is restricted by Resource Access Control Facility (RACF). Contractor is required to maintain confidentiality safeguards with respect to these records.
Implementation guidelines: Safeguards are established in accordance with Chapter 45-13 and PHS hf:45-13 of the Department's General Administration Manual and Part 6 of the Department's ADP Systems Manual.

Retention and disposal:
Indefinite retention on magnetic disc.

System manager(s) and address:
Program Manager, U.S.P.H.S. Personnel Monitoring Program, Office of Health Physics (HFZ-60), Center for Devices and Radiological Health, 5600 Fishers Lane, Rockville, MD 20857.

Notification procedure:
An individual may learn of his or her record upon written request, with notarized signature if request is made by mail, or with identification if request is made in person, directed to: FDA Privacy Act Coordinator (HFI-30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857

Record source categories:
Individual on whom the record is maintained.

Systems exempted from certain provisions of the act: None.

From the Privacy Act Online via GPO Access [wais.access.gpo.gov]

09-10-0009

System name: Special Studies and Surveys on FDA-Regulated Products, HHS/FDA/OM.

Security classification: None.

System location:
Division of Contracts and Procurement Management, Office of Contracts and Grants Management, 5600 Fishers Lane, Park Building, Room 3-32, Rockville, MD 20857. A current list of contact sites is available by writing to the system manager at the address below.

Categories of individuals covered by the system:
Individuals, specialty groups, and households participating voluntarily in studies and surveys conducted or sponsored by FDA.

Categories of records in the system:
Data collected vary with each study/survey. Normal standard information for individuals or household members varies but could include name, age, sex, marital status, address or locale of residence, etc. Nondemographic items relate to experience with, or opinions about, a particular product. Patient medical records may be included in some cases involving specific health problems.

Authority for maintenance of the system:
Section 701(a) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et seq.).

Purpose(s):
Used to provide data on individuals, specialty groups, e.g., physicians and households participating voluntarily in studies and surveys conducted or sponsored by FDA.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:
Disclosure may be made to a congressional office from the records of an individual in response to an inquiry from the congressional office made at the request of that individual. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:
Questionnaires and data are filed in standard filing equipment. Some statistical data are stored on magnetic tape.

Retrievability:
Accessed by ID number assigned by FDA or contractor during collection process. Individual files are maintained in agency and/or contractor's custody until all collection procedures are completed.

Safeguards:

Authorized users: Authorized program personnel.
Physical safeguards: Questionnaires and data are maintained in locked containers in secured area. Magnetic tapes are maintained in secured computer facilities. Locked buildings, locked rooms, locked file cabinets and locked tape vaults.
Procedural (or technical) safeguards: Access limited by computer password which is changed periodically. Confidentiality safeguards with respect to these records are required to be maintained.
Implementation guidelines: Safeguards are established in accordance with Chapter 45-13 and PHS hf: 45-13 of the Department's General Administration Manual and Part 6 of the Department's ADP Systems Manual.

Retention and disposal:
Questionnaires and data are retained until all statistical problems are resolved; then destroyed. The records are destroyed by shredding, burning, or other appropriate means so as to render them illegible.

System manager(s) and address:
Chief, Division of Contracts and Procurement Management, 5600 Fishers Lane, Park Building, Room 3-32, Rockville, MD 20857. Office of Epidemiology and Biostatistics (HFD-700), Rockville, MD 20857

Record access procedures:
Same as notification procedure. Requesters should also reasonably specify the record contents being sought. An individual who requests notification of, or access to, a medical record shall, at the time the request is made, designate in writing a responsible representative who will be willing to review the records and inform the subject individual of its contents at the representative's discretion. You may also request an accounting of disclosures that have been made of your record, if any.

Contesting record procedures:
Contact the official at the address specified under Notification Procedure above and reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.

Record source categories:
Individual on whom the record is maintained or patient's medical records, depending on the type of survey or study.

Systems exempted from certain provisions of the act: None.

From the Privacy Act Online via GPO Access [wais.access.gpo.gov]

09-10-0010

System name: Bioresearch Monitoring Information System, HHS/FDA

Security classification: None.

System location:
Center for Biologics Evaluation and Research (CBER), Office of Compliance and Biologics Quality, Bioresearch Monitoring Team (HFM- 650), 1401 Rockville Pike, Rockville, MD 20852. Center for Devices and Radiological Health (CDRH), Office of Compliance, Division of Bioresearch Monitoring (HFZ-310), 2094 Gaither Rd., Rockville, MD 20850. Center for Drug Evaluation and Research (CDER), Office of Compliance, Division of Scientific Investigations (HFD-340), 7520 Standish Pl., Rockville, MD 20855. Center for Food Safety and Applied Nutrition (CFSAN), Office of Premarket Approval, Division of Product Policy (HFS-205), 200 C St. SW., Washington, DC 20204. Center for Veterinary Medicine (CVM), Office of Surveillance & Compliance (HFV-234), Division of Compliance, Bioresearch Monitoring Staff, 7500 Standish Pl., Rockville, MD 20855.

Categories of individuals covered by the system:
Clinical investigators who are conducting, or have conducted, clinical studies of new drugs, biologics, and devices under investigational new drug and biologics, and investigational device exemption requests; clinical investigators who are conducting, or have conducted, studies on food or color additives, generally recognized as safe (GRAS) substances, or infant formula; and clinical investigators who are conducting, or have conducted, studies on new animal drugs under investigational new animal drug requests.

Categories of records in the system:
Automated file is maintained on all clinical investigators; contains name, education, professional qualifications and background, Program Oriented Data Systems (PODS) locator code, and information on studies conducted. Manual file contains, in addition to that same information, investigatory material collected by, or developed by, the Food and Drug Administration (FDA), during investigations of possible violations of statutes and regulations governing new drug, biologic, food or color additive, GRAS substance, infant formula, new animal drug, and/or device studies.

Authority for maintenance of the system:
Section 505(i)(3), Federal Food, Drug, and Cosmetic Act (21 U.S.C. 355(i)(3)), 21 CFR part 312 (new drugs and biologics for investigational use); section 520, Federal Food, Drug, and Cosmetic Act (21 U.S.C. 360j), 21 CFR part 812 (new devices for investigational use); sections 512(j) and (l)(1), Federal Food, Drug, and Cosmetic Act (21 U.S.C. 360b(j) and (l)(1)), 21 CFR part 511 (new animal drugs for investigational use); Sections 409 and 721, Federal Food, Drug, and Cosmetic Act (21 U.S.C. 348 and 379e), 21 CFR part 71 (color additive petitions), 21 CFR part 171 (food additive petitions); section 412, Federal Food, Drug, and Cosmetic Act (21 U.S.C. 350a) (infant formula requirements); and section 351, Public Health Service Act (42 U.S.C. 262).

Purpose(s):
1. To provide controls to assure that investigators meet requirements of the relevant statutes and regulations governing new drug, biologic, food or color additive, GRAS substance, infant formula, new animal drug, and/or device studies.
2.To serve as a data base for the effective performance of activities necessary for the conduct of the bioresearch monitoring program.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:

Records that indicate a violation or potential violation of law, may be:
(1) Referred for investigation and possible enforcement action under the applicable Federal, State, or foreign laws to the Department of Justice and other appropriate Federal agencies, an appropriate State food and drug enforcement agency or licensing authority, or the government of a foreign country where studies are being or have been conducted; or (2) disclosed to sponsors or IRB's responsible for initiating, approving, monitoring, or overseeing any studies affected by the violation or potential violation, if the information disclosed is relevant to any enforcement, regulatory, investigative, or prosecutorial responsibility of the receiving entity.

2. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the written request of that individual.

3. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other adjudicative body, when:
(a) HHS, or any component thereof; or
(b) Any HHS employee in his or her official capacity; or
(c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
(d) The United States or any agency thereof (where HHS determines that the litigation is likely to affect HHS or any of its components), is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other adjudicative body, is relevant and necessary to the litigation and would help in the effective representation of the governmental interest, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected. Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:
Manual files of investigatory materials are maintained in letter- size manila folders and on microfilm. Automated files are maintained on magnetic disk or tape.

Retrievability:
Indexed by name or code number.

Safeguards:
1. Authorized users: Personnel in CBER's Bioresearch Monitoring Team and CBER Product Review Offices; Personnel in CDRH's Division of Bioresearch Monitoring; Personnel in CDER's Division of Scientific Investigations, Division of Drug Information Resources, Management and Data Systems Branch; Personnel in CFSAN's Division of Product Policy, Division of Health Effects Evaluation; and Personnel in CVM's Division of Compliance, Bioresearch Monitoring Staff.

2. Physical safeguards: Files are stored in secured areas, locked buildings, locked rooms, locked tape vaults, and lockable data media cabinets.

3. Procedural (or technical) safeguards: Limited access and computer password which is changed periodically.

4. Implementation guidelines: These practices are in compliance with the standards of chapter 45-13 of the HHS General Administration Manual, "Safeguarding Records Contained in Systems of Records,'' supplementary Chapter PHS hf: 45-13, and the Department's Automated Information System Security Handbook.

Retention and disposal:
Records are retained and disposed of under the authority of the FDA Records Control Schedule transmittal number H:90-1, Departmental number B-331.

System manager(s) and address:
Director, Division of Inspections and Surveillance (HFM-650), Center for Biologics Evaluation and Research, Office of Compliance and Biologics Quality, 1401 Rockville Pike, Rockville, MD 20852. Director, Division of Bioresearch Monitoring (HFZ-310), Office of Compliance, Center for Devices and Radiological Health, 2094 Gaither Rd., Rockville, MD 20850.

Notification procedures:
An individual may learn if a record exists about him or her upon written request with notarized signature or certification of identification under penalty of perjury if request is made by mail, or with identification if request is made in person (see also 21 CFR 21.44), directed to: FDA Privacy Act Coordinator (HFI-30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857.

Contesting record procedures:
Contact the official at the address specified under notification procedures above and reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.

Record source categories:
Individual on whom the record is maintained. Some material is obtained from third parties, e.g., drug companies, publications, or is developed by FDA.

Systems exempted from certain provisions of the act:
This system is exempt from access and contest and certain other provisions of the Privacy Act (5 U.S.C. 552a(c)(3), (d)(1) to (d)(4), (e)(3), (e)(4)(G) to (e)(4)(H) and (f)) to the extent that it includes investigatory material compiled for law enforcement purposes, where access would be likely to prejudice the conduct of the investigation.

From the Privacy Act Online via GPO Access [wais.access.gpo.gov]

09-10-0011

System name: Certified Retort Operators, HHS/FDA/CFSAN.

Security classification: None.

System location:
Division of Hazard Analysis Critical Control Point, (HACCP) Programs (HFS-615), Center for Food Safety and Applied Nutrition, 200 C Street, SW, Washington, DC 20204.

Categories of individuals covered by the system:
Food industry employees who have attended courses of instruction relating to operation of retorts.

Categories of records in the system:
Contains name and training records. Authority for maintenance of the system: Section 404 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 344).

Purpose(s):
To ascertain that programs exist in regulated establishments relating to food industry employees instructed in operating retorts.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:

Records in this system showing a low-acid canned food establishment not having supervised canning retort operations may be:
(1) Referred for investigation and possible enforcement action against the company and responsible officials, to the Department of Justice, or appropriate State food and drug law enforcement agencies, or
(2) disclosed in administrative or court proceedings in determining whether a record is relevant to an agency decision concerning documents of investigatory materials. Most records in the system may be disclosed to a food company who may be advised as to whether an individual has satisfied FDA requirements.

Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
(a) HHS, or any component thereof; or
(b) Any HHS employee in his or her official capacity; or
(c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
(d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:
Maintained in standard filing equipment.

Retrievability:
Indexed by name.

Safeguards:
1. Authorized users: Limited access to professional staff and secretary of the Regulatory Food Chemistry Branch.

2. Physical safeguards: Records are stored in locked containers in locked rooms and building.

3. Procedural safeguards: Users of personal information in connection with the performance of their jobs have been instructed to protect such information from public view and from unauthorized personnel. Access to records is strictly limited to those staff members trained in accordance with the Privacy Act.

4. Implementation guidelines: Safeguards are established in accordance with Chapter 45-13 and PHS hf:45-13 of the Department's General Administration Manual.

System manager(s) and address:
Director, Division of Hazard Analysis Critical Control Point (HACCP) Programs (HFS-615), Center for Food Safety and Applied Nutrition, 200 C Street, SW, Washington, DC 20204. Notification procedure: An individual may learn if a record exists about him or her upon written request, with notarized signature if request is made by mail, or with identification if request is made in person, directed to: FDA Privacy Act Coordinator (HFI-30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857.

Contesting record procedures:
Contact the official at the address specified under the notification procedure and reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.

Record source categories:
Educational institutions that conduct retort operator training.

Systems exempted from certain provisions of the act: None.

From the Privacy Act Online via GPO Access [wais.access.gpo.gov]

09-10-0013

System name: Employee Conduct Investigative Records, HHS/FDA/OM.

Security classification: None.

System location:
Office of Internal Affairs (HF-9), Office of the Commissioner, 1801 Rockville Pike, Suite 405, Rockville, MD 20857.

Categories of individuals covered by the system:

Employees or former employees, or special Government employees of FDA who are alleged to have violated FDA or Departmental regulations and/or Federal statutes.

Categories of records in the system:
This system includes records relating to correspondence concerning an individual's employment status or conduct while employed by FDA. Examples of these records include: Correspondence from employees, members of Congress and members of the public alleging misconduct by an official of FDA. It also contains reports of investigations to resolve allegations of misconduct or violations of statutes, with related exhibits of statements, affidavits or records obtained during the investigation; reports of action taken by management; decisions on any misconduct substantiated by the investigation; and reports of legal action resulting from violations of statutes referred for prosecution.

Authority for maintenance of the system:
5 U.S.C. 301; Title 18, U.S.C. (e.g., 18 U.S.C. 201, 203, 207, 208, 209, 1905); 21 U.S.C. 331; 28 U.S.C. 535(b); 44 U.S.C. 3101; E.0. 10450 and 45 CFR part 73.

Purpose(s):
To provide management with information needed to take actions against complaints or alleged violations. These complaints may be referred to the Office of Inspector General, Office of the Secretary, HHS.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:

Records that indicate violation or potential violation of law regulation and/or policy may be:
(1) Referred for investigation and possible enforcement action under the applicable Federal, state, or foreign laws to the Department of Justice; an appropriate state food and drug enforcement health agency or licensing authority; or the government of a foreign country; or
(2) disclosed in administrative or court proceedings in determining whether a record is relevant to an agency decision concerning documents of investigatory materials.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:
Paper and automated records, in folders, in file cabinets, and on FDA central computer.

Retrievability:
Alphabetically by name.

Safeguards:
1. Authorized users: Limited access to Division of Ethics and Program Integrity Staff and authorized support staff of the Office of Management and Operations.

2. Physical safeguards: Records are maintained in locked rooms within a locked secured area protected by a 24-hour building guard service.

3. Procedural safeguards: Users of personal information in connection with the performance of their jobs have been instructed to protect such information from public view and from unauthorized personnel. Access is strictly limited to those employees trained in accordance with the Privacy Act. Access to computer records is via user passwords and system access codes.

4. Implementation guidelines: Safeguards are established in accordance with Chapters 45-13 of the Department's General Administration Manual.

Retention and disposal:
Records are retained until 5 years after termination of employment of subject individual or when no longer needed for reference. Disposal of records is accomplished by shredding, burning, or other appropriate means so as to render them illegible.

System manager(s) and address:
Special Agent in Charge, Office of Internal Affairs (HFD-9), Office of the Commissioner, 1801 Rockville, MD 20852.

Record access procedures:
Same as notification procedure. Requesters should also reasonably specify the record contents being sought. Access to record systems which have been granted an exemption from the Privacy Act access requirement may be made at the discretion of the system manager. If access is denied to requested records an appeal may be made to: Commissioner, Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857 You may also request an accounting of disclosures that have been made of your record, if any.

Contesting record procedures:
If access has been granted, contact the official at the address specified under notification procedure above and reasonably identify the record, specify the information being contested, the corrective action sought, and your reasons for requesting the correction, along with supporting information to show how the record is inaccurate, incomplete, untimely, or irrelevant.

Record source categories:
Information in this system of records is obtained from FDA personnel and FDA records, subjects of investigations, complaints, witnesses, other Federal agencies, State and local agencies, and personal observations by the investigator.

Systems exempted from certain provisions of the act:
This system is exempt from access and contest and certain other provisions of the Privacy Act, (5 U.S.C. 552a(c)(3), (d) (1) to (4), (e)(3), (e)(4) (G) to (H), and (f)), to the extent that it includes investigatory material compiled for law enforcement purposes, including criminal law enforcements.

From the Privacy Act Online via GPO Access [wais.access.gpo.gov]

09-10-0017

System name: Epidemiological Research Studies of the Center for Devices and Radiological Health, HHS/FDA/CDRH.

Security classification: None.

System location:
Epidemiology Branch (HFZ-541), Division of Postmarket Surveillance, Center for Devices and Radiological Health, 1350 Piccard Drive, Rockville, MD 20850.

Categories of individuals covered by the system:
Persons who have been exposed to radiation (ionizing, nonionizing, sonic) from either medical, occupational or environmental sources; patients with cancer, birth defects, or other diseases or conditions which result from radiation exposure; unexposed persons (e.g., family members) for the purpose of making comparisons.

Categories of records in the system:
ID number, Social Security number which is supplied on a voluntary basis, name, demographic characteristics, radiation exposure, occupational and personal health histories, medical data, and information on or from death certificates, if deceased.

Authority for maintenance of the system:
Public Health Service Act, sections 301, 310, 354, 356, and 357, 42 U.S.C. 241, 242A, 263b, 263c, and 263d. Federal Food, Drug, and Cosmetic Act, section 702(a), 21 U.S.C. 372(a). Reorganization Plan No. 3 of 1970, Section 2.

Purpose(s):
To maintain records used by epidemiologists, statisticians, and authorized staff for epidemiological research and analyses on the effect of radiation exposure.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:
A record may be disclosed for a research purpose, when the Department:
(a) Has determined that the use or disclosure does not violate legal or policy limitations under which the record was provided, collected, or obtained;
(b) has determined that the research purpose (1) cannot be reasonably accomplished unless the record is provided in individually identifiable form, and (2) warrants the risk to the privacy of the individual that additional exposure of the record might bring;
(c) has required the recipient to-- (1) establish reasonable administrative, technical, and physical safeguards to prevent unauthorized use or disclosure of the record, and (2) remove or destroy the information that identifies the individual at the earliest time at which removal or destruction can be accomplished consistent with the purpose of the research project, unless the recipient has presented adequate justification of a research or health nature for retaining such information, and (3) make no further use or disclosure of the record except-- (A) in emergency circumstances affecting the health or safety of any individual, (B) for use in another research project, under these same conditions, and with written authorization of the Department, (C) for disclosure to a properly identified person for the purpose of an audit related to the research project, if information that would enable research subjects to be identified is removed or destroyed at the earliest opportunity consistent with the purpose of the audit, or (D) when required by law;
(d) has secured a written statement attesting to the recipient's understanding of, and willingness to abide these provisions. Records in the system may be made available to Federal, state, and local agencies having an interest in protecting the public from the effects of radiation. Disclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual. In the event of litigation where the defendant is (a) the Department, any component of the Department, or any employee of the Department in his or her official capacity; (b) the United States where the Department determines that the claim, if successful, is likely to directly affect the operations of the Department or any of its components; or (c) any Department employee in his or her individual capacity where the Justice Department has agreed to represent such employee, for example in defending a claim against the Public Health Service based upon an individual's mental or physical condition and alleged to have arisen because of activities of the Public Health Service in connection with such individual, disclosure may be made to the Department of Justice to enable that Department to present an effective defense, provided that such disclosure is compatible with the purpose for which the records were collected.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:
Records are stored in file folders, on punch cards and on magnetic tape and discs, computer printouts and on microfiche. Retrievability: Records are retrieved by name and study number.

Safeguards:
1. Authorized users: Designated employees of the Center for Devices and Radiological Health.

2. Physical safeguards: Data collection instruments are stored in locked file cabinets, locked rooms, and locked buildings.

3. Procedural (or technical) safeguards: Name listings and log books containing information to permit the identification of an individual and microfilmed records are kept in locked files. Computer password is changed periodically.

4. Implementation guidelines: Safeguards are established in accordance with Chapter 45-13 and PHS hf:45-13 of the Department's General Administration Manual and Part 6 of the Department's ADP Systems Manual.

Retention and disposal:
One year to permanently, depending on the length of follow-up required to complete all phases of the study. The records are destroyed by shredding, burning, or other appropriate means so as to render them illegible. Computer tapes and discs are erased.

System manager(s) and address:
Chief, Epidemiology Branch (HFZ-116), Division of Biometric Sciences, Center for Devices and Radiological Health, 5600 Fishers Lane, Rockville, MD 20857. Notification procedure: An individual may learn if a record exists about him or her upon written request, with notarized signature if request is made by mail, or with identification if request is made in person, directed to: FDA Privacy Act Coordinator (HFI-30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857.

Record access procedures:
Same as notification procedure. Requesters should also reasonably specify the record contents being sought. An individual who requests notification of, or access to, a medical record shall at the time the request is made, designate in writing a responsible representative who will be willing to review the record and inform the subject individual of its contents at the representative's discretion. You may also request an accounting of disclosures that have been made of your record, if any.

Record source categories:
Individuals in the system of records, employers, health care providers and facilities, administrative and vital statistics agencies.

Systems exempted from certain provisions of the act:
None.

From the Privacy Act Online via GPO Access [wais.access.gpo.gov]

09-10-0018

System name: Employee Identification Card Information Record, HHS/FDA/OC.

Security classification: None.

System location:
Personal Property Management Section, Services Unit (HFA-227), 5600 Fishers Lane, Rockville, MD 20857 Metropolitan Office Services Unit (HFA-216), 200 C Street, SW, Washington, DC 20204 Physical Security Staff (HFA-204), 7500 Standish Place, MPN, Rm. N-378, Rockville, MD 20855. Administrative Branch at Field/District Offices. For the location of Field/District Offices, see appendix A to system notice 09-10- 0002, Regulated Industry Employee Enforcement Records, HHS/FDA/OC.

Categories of individuals covered by the system:
Approximately 8,000 FDA employees.

Categories of records in the system:
Contains name, mail routing code, office telephone number, building, room number, birthdate, sex, identification photograph, height, weight, color of eyes, color of hair, and type of appointment.

Authority for maintenance of the system:
40 U.S.C. 471, et seq; Management and Disposal of Government Property Act.

Purpose(s):
The system is designed to maintain a record of all holders of FDA identification cards and security card keys, Forms HHS 576 (FDA employees only) FDA 2923, and FDA 3391, for renewal and recovery purposes and to identify numbers of lost or stolen cards. The system may also be used at FDA Headquarters to locate employees whose names have not been entered in the FDA locator system.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:
Disclosure may be made to a Congressional office from the record of an individual in response to an inquiry from the Congressional office made at the request of that individual. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
(a) HHS, or any component thereof; or
(b) Any HHS employee in his or her official capacity; or
(c) Any HHS employee in his or her individual capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
(d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components, is a party to litigation or has an interest in such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:
Forms filed in folders in a locked filing cabinet. Computer tapes and discs stored in a locked safe. Retrievability: Information is filed and retrieved by name and date of birth.

Safeguards:
1. Authorized users: Authorized FDA personnel whose official duties require access for issuance, renewal, retrieval, and location purposes.

2. Physical safeguards: Records are kept in locked file cabinets and on minicomputers at Headquarters and are maintained in secured areas. Computer discs and tapes are stored in locked safes.

3. Procedural (or technical) safeguards: Computer software providing restricted commands.

Retention and disposal:
Records are maintained as long as the cards are valid. Computer tapes are erased immediately upon termination of employment and inactive forms are destroyed after 6 months by shredding. System manager(s) and address: Chief, Administrative Services Branch (HFA-210), 5600 Fishers Lane, Rockville, MD 20857. Chief, Physical Security Staff (HFA-204), 7500 Standish Place, MPN II, Rm. N-378, Rockville, MD 20855.

Record access procedures:
Same as notification procedure. Requesters should also reasonably specify the record contents being sought, and provide any other names officially used during period of employment. You may also request an accounting of disclosures that have been made of your record, if any.

Record source categories:
Individual on whom the record is maintained.

Systems exempted from certain provisions of the act:
None.

From the Privacy Act Online via GPO Access [wais.access.gpo.gov]

09-10-0019

System name: Mammography Quality Standards Act (MQSA) Training Records, HHS/ FDA/CDRH.

Security classification: None.

System location:
Division of Mammography Quality amd Radiation Programs (HFZ-240), Center for Devices and Radiological Health, 1350 Piccard Drive, Rockville, Maryland 20850. A current list of contractor sites is available by writing to the System manager, indicated below, at this address.

Categories of individuals covered by the system:
All individuals who receive training for the purpose of implementing the Mammography Quality Standards Act of 1992; individuals who successfully complete the training will become certified to conduct inspections and audits of mammograph facilities.

Categories of records in the system:
Contains name; date of birth; education; professional experience; employment address; dates of mammography training; participant's test scores, class grades, and an analysis of those scores; dates of certification of the inspector; dates of renewal or withdrawal of certification; and an evaluation of the inspector's field performance (records of complaints received and how the complaints received and how the complaints were resolved).

Authority for maintenance of the system:
Pub. L. 102-539, the Mammography Quality Standards Act (MQSA) of 1992 (42 U.S.C. 263b). Purpose: To provide the Food and Drug Administration (FDA) with information about the training, certification, and recertification of MQSA inspectors for the purpose of implementing the Mammography Quality Standards Act of 1992.

Routine uses of records maintained in the system, including categories of users and the purposes of such uses:
1. Disclosure may be made to a congressional office from the records of an individuals, in response to an inquiry from the congressional office made at the request of that individual.
2. The Department of Health and Human Services (HHS) may disclose information from this system of records to the Department of Justice, or to a court or other tribunal, when
(a) HHS, or any component thereof; or
(b) Any HHS employee in his or her official capacity; or
(c) Any HHS employee in his or her official capacity where the Department of Justice (or HHS, where it is authorized to do so) has agreed to represent the employee; or
(d) The United States or any agency thereof where HHS determines that the litigation is likely to affect HHS or any of its components. is a party to litigation or has an interest to such litigation, and HHS determines that the use of such records by the Department of Justice, the court or other tribunal, is relevant and necessary to the litigation and would help in the effective representation of the governmental party, provided, however, that in each case, HHS determines that such disclosure is compatible with the purpose for which the records were collected.
3. Disclosure may be made with the individual's supervisor since MQSA inspections will be a significant part of many inspector's jobs; therefore, performance in the training courses is an importance element of information to help the supervisor determine employee assignments as well as the level of supervision needed.
4. Disclosure may be made to contractors for the purpose of collecting, compiling, aggregating, analyzing, or refining records in the system. Contractors will be required to maintain Privacy Act safeguards with respect to such records.

Policies and practices for storing, retrieving, accessing, retaining, and disposing of records in the system:

Storage:
Data are maintained in hard copy files and on computer disks, hard drive, and file servers. Retrievability: Indexed by name, state, specific courses, training dates, grades, date of certification, and date of withdrawal of certification.

Safeguards:
1. Authorized users: Personnel of the Division of Mammography Quality Reporting Program who are engaged in training the individuals who inspect mammography facilities, and personnel in the Division who compile and analyze the test and personal data of the students.

2. Physical safeguards: All records (such as diskettes, computer listings, or documents) are kept in a secured area, locked rooms, and locked building. The facility has a 24-hour guard service, and access to the building is further controlled by an operational card key system. Access to the computer room is limited to a subset of persons with general access to the building. Access to individual offices is controlled by simplex locks. The building has smoke/fire detectors; the computer room has additional smoke/fire detectors plus water, temperature, and humidity sensors. The computers room has an uninterruptible power supply and a power supply and a power conditioning system.

3.Procedural safeguards: End users and system professionals continue to receive regular training in information systems security and have signed an agreement indicating their cooperation with FDA policies. Users are further instructed on system security during training sessions for this application and in accordance with the Privacy Act. Users of personal information in the performance of their duties have been instructed to protect personal information from public views and from unauthorized personnel. All reports containing confidential data are marked ``confidential'' and placed in the developer's or system manager's mail slot, which is located in an access-controlled room. CDRH SOP requires that all reports containing confidential information be shredded before disposal.

4. Technical safeguards: All users have individual IDS and regularly expiring passwords at least 6 characters long. All users are assigned specific levels of database control based on their needs and authority. All users of valid IDs and passwords will be monitored. Upon job change, the user's authorization is reviewed and updated as necessary.

All changes to data, as well as the time of change and the operator's ID are captured in a file as part of the database design. All data entered online is edited checked. The system's intrusion alarms, which list all logins and their source, are monitored daily by the Information Systems Security Officer. In addition, CDRH maintains commercial auditing software that permit logging of keystrokes by individual accounts.

CDRH maintains three audits trails for this system:
1. System-wide intrusion alarms and file access notices.
2. Application-dependent logging of all data transactions.
3. Commercial software that permits capturing all keystrokes from suspicious accounts and terminals.
All systems in support of this database are under the control of CDRH and meet the same security standards as the application.
5. Inplementation guidelines: Safeguards are established in accordance with Chapter 45-13 and PHS hf:45-13 of the Department's General Administration Manual and the Department's Automated Information Systems Security Handbook.

Retention and disposal:
Records are retained for five years after the certificed MQSA inspector leaves government service. At the end of five years, in individual's paper records are shredded and automated records are erased. System manager(s) and address: Director, Division of Mammography Quality and Radiation Programs (HFZ-240), Center for Devices and Radiological Health, 1350 Piccard Drive, Rockville, Maryland 20850.

Notification procedure:
An individual may learn if a record exists about him or her upon written request, with notarized signature if request is made by mail, or with identification if request is made in person, directed to: FDA Privacy Act Coordinator (HF1-30), Food and Drug Administration, 5600 Fishers Lane, Rockville, MD 20857. Record access procedures: Same as notification procedure. Requests should also reasonably specify the record contents being sought. You may also request an accounting of disclosures that have been made of your record, if any.

Record source categories:
Individuals on whom the record is maintained and training records pertaining to that individual. Information about certification renewal or withdrawal is generated in-house by the Division of Mammography Quality and Radiation Programs. Sources of information about field performance could include the inspector's supervisor, as well as any investigation of an inspector's performance as a result of an inspector's performance as a result of complaints by a mammography facility.

horizontal rule

Food and Drug Administration From the Privacy Act Online via GPO Access

Table of Contents

Food and Drug Administration
From the Privacy Act Online via GPO Access